diff --git a/host-interaction/file-system/files/list/enumerate-files-on-linux.yml b/host-interaction/file-system/files/list/enumerate-files-on-linux.yml index 75f7a94a7..d8c4340f5 100644 --- a/host-interaction/file-system/files/list/enumerate-files-on-linux.yml +++ b/host-interaction/file-system/files/list/enumerate-files-on-linux.yml @@ -15,7 +15,9 @@ rule: - 7351f8a40c5450557b24622417fc478d:0x405438 features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - and: - match: create or open file diff --git a/host-interaction/file-system/files/list/enumerate-files-recursively.yml b/host-interaction/file-system/files/list/enumerate-files-recursively.yml index f995d147f..ac0d3cf32 100644 --- a/host-interaction/file-system/files/list/enumerate-files-recursively.yml +++ b/host-interaction/file-system/files/list/enumerate-files-recursively.yml @@ -18,4 +18,5 @@ rule: - and: - or: - match: enumerate files on Windows + - match: enumerate files on Linux - characteristic: recursive call diff --git a/host-interaction/file-system/read/read-file-on-linux.yml b/host-interaction/file-system/read/read-file-on-linux.yml index 00af92f36..6d1b30738 100644 --- a/host-interaction/file-system/read/read-file-on-linux.yml +++ b/host-interaction/file-system/read/read-file-on-linux.yml @@ -13,7 +13,9 @@ rule: - 7351f8a40c5450557b24622417fc478d:0x4059AD features: - and: - - os: linux + - or: + - os: linux + - os: android - optional: - match: create or open file - or: diff --git a/host-interaction/file-system/write/write-file-on-linux.yml b/host-interaction/file-system/write/write-file-on-linux.yml index 80e551d13..0be290eb5 100644 --- a/host-interaction/file-system/write/write-file-on-linux.yml +++ b/host-interaction/file-system/write/write-file-on-linux.yml @@ -13,7 +13,9 @@ rule: - 7351f8a40c5450557b24622417fc478d:0x401E14 features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: fputc - api: fputs diff --git a/host-interaction/hardware/memory/get-memory-information.yml b/host-interaction/hardware/memory/get-memory-information.yml index 37203b52b..c8328003b 100644 --- a/host-interaction/hardware/memory/get-memory-information.yml +++ b/host-interaction/hardware/memory/get-memory-information.yml @@ -14,11 +14,15 @@ rule: features: - or: - and: - - os: linux + - or: + - os: linux + - os: android - match: host-interaction/file-system/read - string: "/proc/meminfo" - and: - - os: linux + - or: + - os: linux + - os: android - api: system - or: - substring: "/proc/meminfo" diff --git a/host-interaction/mutex/create-semaphore-on-linux.yml b/host-interaction/mutex/create-semaphore-on-linux.yml index 5adb80524..031460222 100644 --- a/host-interaction/mutex/create-semaphore-on-linux.yml +++ b/host-interaction/mutex/create-semaphore-on-linux.yml @@ -11,5 +11,7 @@ rule: - 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc:0x408de0 features: - and: - - os: linux + - or: + - os: linux + - os: android - api: sem_init diff --git a/host-interaction/mutex/lock-file.yml b/host-interaction/mutex/lock-file.yml index 280ceb7f6..e989e1ee6 100644 --- a/host-interaction/mutex/lock-file.yml +++ b/host-interaction/mutex/lock-file.yml @@ -13,7 +13,9 @@ rule: - 7351f8a40c5450557b24622417fc478d:0x40858F features: - and: - - os: linux + - or: + - os: linux + - os: android - api: fcntl - number: 1 = F_WRLCK - number: 6 = F_SETLK diff --git a/host-interaction/mutex/lock-semaphore-on-linux.yml b/host-interaction/mutex/lock-semaphore-on-linux.yml index 301927621..e0802d963 100644 --- a/host-interaction/mutex/lock-semaphore-on-linux.yml +++ b/host-interaction/mutex/lock-semaphore-on-linux.yml @@ -11,7 +11,9 @@ rule: - 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc:0x408e40 features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: sem_wait - api: sem_timedwait diff --git a/host-interaction/mutex/unlock-semaphore-on-linux.yml b/host-interaction/mutex/unlock-semaphore-on-linux.yml index b33ff115c..66c1a41e6 100644 --- a/host-interaction/mutex/unlock-semaphore-on-linux.yml +++ b/host-interaction/mutex/unlock-semaphore-on-linux.yml @@ -11,5 +11,7 @@ rule: - 294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc:0x408e40 features: - and: - - os: linux + - or: + - os: linux + - os: android - api: sem_post diff --git a/host-interaction/process/create/create-process-on-linux.yml b/host-interaction/process/create/create-process-on-linux.yml index 7fdd46a6d..ab98b7e00 100644 --- a/host-interaction/process/create/create-process-on-linux.yml +++ b/host-interaction/process/create/create-process-on-linux.yml @@ -13,7 +13,9 @@ rule: - 7351f8a40c5450557b24622417fc478d:0x40236D features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: execve - api: execl diff --git a/host-interaction/session/get-current-user-on-linux.yml b/host-interaction/session/get-current-user-on-linux.yml index 29f7a424a..899749722 100644 --- a/host-interaction/session/get-current-user-on-linux.yml +++ b/host-interaction/session/get-current-user-on-linux.yml @@ -13,7 +13,9 @@ rule: - 7351f8a40c5450557b24622417fc478d:0x405438 features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: geteuid - api: getpwuid diff --git a/host-interaction/thread/create/create-thread.yml b/host-interaction/thread/create/create-thread.yml index ba08897e8..fc2f9e8c2 100644 --- a/host-interaction/thread/create/create-thread.yml +++ b/host-interaction/thread/create/create-thread.yml @@ -34,7 +34,9 @@ rule: - api: ntdll.ZwCreateThread - api: ntdll.ZwCreateThreadEx - and: - - os: linux + - or: + - os: linux + - os: android - api: pthread_create - and: - api: System.Threading.Thread::Start diff --git a/lib/delay-execution.yml b/lib/delay-execution.yml index 50da58610..589ea7966 100644 --- a/lib/delay-execution.yml +++ b/lib/delay-execution.yml @@ -36,7 +36,9 @@ rule: - api: KeWaitForSingleObject - api: KeDelayExecutionThread - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: sleep - api: usleep diff --git a/lib/duplicate-stdin-and-stdout.yml b/lib/duplicate-stdin-and-stdout.yml index 0af79eafb..ad4dfb90c 100644 --- a/lib/duplicate-stdin-and-stdout.yml +++ b/lib/duplicate-stdin-and-stdout.yml @@ -11,7 +11,9 @@ rule: - 7351f8a40c5450557b24622417fc478d:0x40236D features: - and: - - os: linux + - or: + - os: linux + - os: android - api: dup2 - number: 0 = STDIN - number: 1 = STDOUT diff --git a/linking/runtime-linking/link-many-functions-at-runtime.yml b/linking/runtime-linking/link-many-functions-at-runtime.yml index 4ac809efe..f2c6fbd34 100644 --- a/linking/runtime-linking/link-many-functions-at-runtime.yml +++ b/linking/runtime-linking/link-many-functions-at-runtime.yml @@ -21,7 +21,9 @@ rule: - count(api(kernel32.GetProcAddress)): 5 or more - count(api(ntdll.LdrGetProcedureAddress)): 5 or more - and: - - os: linux + - or: + - os: linux + - os: android - match: link function at runtime on Linux - or: - count(api(dlsym)): 5 or more diff --git a/nursery/get-current-pid-on-linux.yml b/nursery/get-current-pid-on-linux.yml index c90b87f9d..b77f494e8 100644 --- a/nursery/get-current-pid-on-linux.yml +++ b/nursery/get-current-pid-on-linux.yml @@ -9,7 +9,9 @@ rule: dynamic: call features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: getpid - api: getppid diff --git a/nursery/get-password-database-entry-on-linux.yml b/nursery/get-password-database-entry-on-linux.yml index b57892c5e..bd95e0e18 100644 --- a/nursery/get-password-database-entry-on-linux.yml +++ b/nursery/get-password-database-entry-on-linux.yml @@ -9,7 +9,9 @@ rule: dynamic: call features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: getpwuid - api: getpwuid_r diff --git a/nursery/link-function-at-runtime-on-linux.yml b/nursery/link-function-at-runtime-on-linux.yml index 62c383a9a..3132e37c0 100644 --- a/nursery/link-function-at-runtime-on-linux.yml +++ b/nursery/link-function-at-runtime-on-linux.yml @@ -11,7 +11,9 @@ rule: - Execution::Shared Modules [T1129] features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: dlopen - api: dlmopen diff --git a/nursery/set-thread-name-on-linux.yml b/nursery/set-thread-name-on-linux.yml index 35dd4eae7..5d1cc0ef3 100644 --- a/nursery/set-thread-name-on-linux.yml +++ b/nursery/set-thread-name-on-linux.yml @@ -9,7 +9,9 @@ rule: dynamic: thread features: - and: - - os: linux + - or: + - os: linux + - os: android - or: - api: pthread_setname_np - and: